$50K in Bug Bounties Confirms AI Customer Service Agents Are Live Attack Targets
What happened
Security researchers at Intigriti published Hacking AI customer service agents, a practitioner report presented at Bug Bounty Village during DEF CON 34, detailing successful attacks against production AI customer service deployments. The research yielded over $50,000 in bounties earned entirely through manual techniques, with no automated scanning tools involved. Attack chains included prompt injection delivered via email to agents with inbox access, phishing campaigns sent from legitimate support addresses after agent compromise, MFA bypass, and one-time password exfiltration through agent tool-calling workflows. These attack classes exploit the expanded trust surface that AI agents create when they are granted access to email systems, authentication flows, and customer account tools. The findings build on a growing body of research, including prior work on ASCII Smuggling Bridges Email Phishing and AI Prompt Injection at Scale and Hidden HTML Prompt Injection Fools AI Email Summarizers With 100% Success Rate, confirming that email-channel injection is an active, exploitable risk in production environments.
Why it matters
- ·Enterprises approving AI customer service agents through standard vendor intake processes are unlikely to have evaluated prompt injection via email, MFA bypass, or OTP exfiltration as live risk categories. These gaps sit outside conventional application security threat models and require agent-specific controls.
- ·When an AI agent sends phishing messages from a legitimate support address, the enterprise may bear liability for those communications. Authentication bypass through agent tool access creates credential and fraud exposure that existing incident classification frameworks may not cover.
- ·The bounty program validation means adversaries already understand these attack chains. Enterprises that have not conducted agent-specific red-teaming against their customer service deployments are operating with an unexamined attack surface in production.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit all deployed AI customer service agents for email integration access and revoke or scope-limit any permissions that allow agents to send outbound email without human approval.
- ☐Require agent-specific red-teaming that explicitly tests prompt injection via email, phishing via support addresses, and authentication workflow manipulation before the next deployment review.
- ☐Review vendor contracts for AI customer service platforms to confirm incident notification requirements cover agent-facilitated phishing and credential exfiltration, not just data breaches.
- ☐Map agent tool-calling permissions against the principle of least privilege: agents that handle authentication workflows should not have access to outbound communication channels without explicit scoping.
- ☐Update the AI incident classification framework to include agent-facilitated phishing, MFA bypass, and OTP exfiltration as named incident categories with defined response procedures.
What to watch next
The Intigriti research is one of several converging signals that agent-specific red-teaming is moving from best practice toward a baseline expectation. Compliance teams should monitor whether bug bounty platforms begin publishing structured taxonomies of AI agent attack classes, which would accelerate regulatory and auditor expectations for pre-deployment testing scope. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already identifies prompt injection and unauthorized action as priority risks. Enforcement bodies that incorporate that guidance into inspection criteria will likely scrutinize whether organizations tested email-channel injection paths before deploying customer-facing agents.